Technical information
Malicious functions:
Sends SMS messages:
- 21213: start lovetip
- 21213: start nut
Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) yellowl####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) 1####.217.168.206:443
DNS requests:
- f####.google####.com
- f####.gst####.com
- mt####.go####.com
- www.go####.com
- yellowl####.com
HTTP GET requests:
- www.go####.com/complete/search?hl=####&client=####&q=####
- yellowl####.com/
- yellowl####.com/category/geographic-contact/
- yellowl####.com/category/tourism/
- yellowl####.com/favicon.ico
- yellowl####.com/geographic-contact-of-sherpur/
- yellowl####.com/wp-content/themes/twentytwelve/js/navigation.js?ver=####
- yellowl####.com/wp-content/themes/twentytwelve/style.css?ver=####
- yellowl####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- yellowl####.com/wp-includes/js/jquery/jquery.js?ver=####
- yellowl####.com/wp-includes/js/wp-embed.min.js?ver=####
- yellowl####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
Modified file system:
Creates the following files:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/index
- /data/data/####/net.isl.gp_preferences.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Contains functionality to send SMS messages automatically.
Displays its own windows over windows of other applications.
